Information on the processing of personal data
Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). Last updated: 4 November 2026.
1. Data controller
p
Humatic, Viale Stelvio 53, Milan, VAT number IT14670580969. Data protection contact: privacy@humatic.work.
2. Scope
p
This notice concerns the people registered with Humatic, the visitors of the humatic.work website and anyone who writes to Humatic through the contact forms of the website. People invited to a study from a client's list receive the notice of that study.
3. Data processed, purposes and legal bases
tabella
- purpose
- data
- legal basis
- retention
Creation and management of the account
email, phone number, language, country
performance of the service (Art. 6.1.b)
while the account is active; on deletion, as in section 10
Identity verification, one account per person
outcome of the verification; first name, last name and year of birth read from the document; one code from the tax code that does not allow the tax code to be derived
legitimate interest in preventing false sign-ups (Art. 6.1.f)
while the account is active; on deletion, as in section 10
Invitations to studies
email, phone number, profile
performance of the service (Art. 6.1.b)
as the account
Conduct of the interview and delivery to the client
questions and answers, audio of the answers given by voice, only to transcribe them
performance of the service (Art. 6.1.b)
twelve months from delivery, or from the start if the interview is not delivered; longer only during a review request or the sending of a voucher
Verification of the genuineness of the answers
answers, measurements of how the interview was carried out; for the answers given by voice: the length of the voice message compared with the time elapsed since the question appeared; the voice messages interrupted by leaving the page
legitimate interest (Art. 6.1.f)
as the interview
Profile update
information that emerged from the interviews, with its source
legitimate interest (Art. 6.1.f)
while the account exists; each item can be deleted from the personal area
Sensitive topics
answers on racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify a person, health, sex life or sexual orientation
explicit consent (Art. 9.2.a)
as the interview; health information does not enter the profile
Reward
voucher code, amount, date
performance of the service (Art. 6.1.b)
as a cost record, until 31 December of the sixth year after the year of the voucher
Tax obligations on vouchers purchased by Humatic
tax code, amount
legal obligation (Art. 6.1.c)
until 31 December of the sixth year after the year of the voucher
Proof of consent
accepted text, version, date and time
legal obligation (Art. 6.1.c; Art. 7.1)
while the account is active, then five years from deletion
Origin of the visit
page and campaign from which the person arrived on the website
legitimate interest: assessing the effectiveness of the channels through which Humatic makes itself known (Art. 6.1.f)
while the account exists
Website measurement
page usage data
consent (Art. 6.1.a)
fourteen months from the last visit
Security of the service
network address, requested page, date and time
legitimate interest (Art. 6.1.f)
no longer than twelve months
Requests from the form for companies
name, company, email, text of the request, language of the page, answer to "How did you find us?", starting guide, campaign from which the person arrived on the website
pre-contractual measures (Art. 6.1.b); for the origin, legitimate interest (Art. 6.1.f)
twelve months from the last contact if the request is not followed by a relationship; in case of a relationship, the terms of that relationship; in case of a dispute, the time needed to handle it
Messages from the "Write to us" form
name, email, text of the message, language of the page
pre-contractual measures at the request of the data subject (Art. 6.1.b), when the message concerns our services; in other cases, legitimate interest in replying to those who write to us (Art. 6.1.f)
twelve months from the last contact; in case of a dispute, the time needed to handle it
Assistance requests from the personal area
name, email, topic and text of the request
performance of the service (Art. 6.1.b)
twelve months from the last contact; in case of a dispute, the time needed to handle it
Recognising those who withdraw consent after receiving the reward
irreversible fingerprint of the email, date; for the assessment by a person at Humatic: the study, the action and, if the person still has an account, their profile
legitimate interest against fraud (Art. 6.1.f)
twelve months
p
Right to object.
Processing based on legitimate interest can be objected to at any time by writing to privacy@humatic.work. For the origin of the visit and for the answer to "How did you find us?", an objection results in the removal of the data from the profile or from the request.
4. Mandatory data
p
Email, phone number and identity document are required to sign up: without them, the sign-up is not completed. Profile questions marked as optional are not mandatory; not answering reduces the number of studies for which the profile is suitable.
5. Decisions and interview conducted by an artificial intelligence system
p
The interview is conducted by an artificial intelligence system. You can also answer with a voice message: it is transcribed; Humatic does not keep the audio and the service that transcribes it states that it keeps neither the audio nor the text. A second system assesses the genuineness of the answers; the reward depends on that assessment. Every negative assessment is examined by a person at Humatic, who decides definitively. Exclusion from the platform is always decided by a person.
6. What the client receives
p
The client receives the answers under a code, without the person's name or contact details, with the outcome of the assessment and, if the interview is approved, its reasons.
7. Recipients
p
The data are processed by authorised Humatic staff and, on behalf of Humatic, by processors bound by contract, in the following categories:
elenco
- verification of identity documents (European Union);
- infrastructure and storage (European Union);
- sending of emails (European Union);
- mailbox that receives the emails addressed to Humatic (also outside the European Union);
- management of access to the account (United States);
- artificial intelligence models that conduct and assess the interview (United States);
- service that transcribes the answers given by voice (European Union; the contract also allows processing in the United States);
- artificial intelligence model of the guides assistant (European Union);
- website measurement, only with consent (United States).
p
The list of processors is available on request at privacy@humatic.work. The data are not sold or passed on for advertising purposes.
8. Transfers outside the European Union
p
Transfers to recipients based in the United States take place on the basis of the safeguards provided for by the GDPR (the European Commission's adequacy decision for the United States, EU-U.S. Data Privacy Framework, for recipients that adhere to it; the European Commission's standard contractual clauses in the other cases).
9. Guides assistant
p
The guide pages offer Clara, an assistant based on artificial intelligence. Clara does not ask for personal data. Messages pass through the Humatic server only to generate the reply and Humatic does not store them; the conversation stays in the browser and is deleted when the tab is closed. The model that generates the replies, from a European Union company, receives the text of the guide and the messages, without network address or identifiers; it keeps them for thirty days for abuse checks and does not use them for training. Conversations are not used for profiling or advertising.
10. Rights of the data subject
p
Access, rectification, erasure, restriction, portability, objection, withdrawal of consent at any time without affecting the processing carried out before: by writing to privacy@humatic.work. Account deletion is started from the personal area.
p
When the account is closed, access is closed and invitations stop; the data remain and the profile can be reactivated on request. With complete removal, name, year of birth and contact details are removed from the profile and kept in an encrypted copy, which can be opened only to handle a dispute and is deleted after five years or when the dispute is closed, together with the proof of consent; the profile without name or contact details remains with no expiry. In both cases a fingerprint of the document remains with no expiry, from which the tax code cannot be derived, used to recognise a new access with the same document. For vouchers purchased by Humatic, amount and tax code remain until 31 December of the sixth year after the year of the voucher, as required by law.
11. Complaint
p
To the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it).